1. 11 11月, 2014 1 次提交
    • F
      usb: dwc3: ep0: fix for dead code · 520fe763
      Felipe Balbi 提交于
      commit 6856d30c (usb: dwc3: ep0: return early
      on NULL requests) tried to fix a minor corner
      case where we could dereference a NULL pointer
      but it also ended up introducing some dead code.
      
      Unfortunately, that dead code, if reached, could
      end up starving the endpoint request list because
      a request would never be given back when it should.
      
      Fix this by moving the check for empty request list
      before its first use.
      Reported-by: NDave Jones <davej@redhat.com>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      520fe763
  2. 07 11月, 2014 1 次提交
  3. 06 11月, 2014 3 次提交
  4. 04 11月, 2014 16 次提交
  5. 03 11月, 2014 2 次提交
  6. 28 10月, 2014 1 次提交
  7. 27 10月, 2014 1 次提交
  8. 24 10月, 2014 5 次提交
  9. 23 10月, 2014 10 次提交
    • C
      usb: dwc2: Bits in bitfield should add up to 32 · fd4850cf
      Charles Manning 提交于
      The unioned u32 is used for clearing etc. Having the number of
      bitfield bits add up to more than 32 is broken, even if benign.
      Acked-by: NPaul Zimmerman <paulz@synopsys.com>
      Signed-off-by: NCharles Manning <cdhmanning@gmail.com>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      fd4850cf
    • S
      usb: dwc2: gadget: sparse warning of context imbalance · b585a48b
      Sudip Mukherjee 提交于
      sparse was giving the following warning:
              warning: context imbalance in 's3c_hsotg_ep_enable'
      	                - different lock contexts for basic block
      
      we were returning ENOMEM while still holding the spinlock.
      The sparse warning was fixed by releasing the spinlock before return.
      
      Cc: <stable@vger.kernel.org> # v3.17
      Acked-by: NPaul Zimmerman <paulz@synopsys.com>
      Signed-off-by: NSudip Mukherjee <sudip@vectorindia.org>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      b585a48b
    • F
      usb: gadget: udc: core: fix kernel oops with soft-connect · bfa6b18c
      Felipe Balbi 提交于
      Currently, there's no guarantee that udc->driver
      will be valid when using soft_connect sysfs
      interface. In fact, we can very easily trigger
      a NULL pointer dereference by trying to disconnect
      when a gadget driver isn't loaded.
      
      Fix this bug:
      
      ~# echo disconnect > soft_connect
      [   33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014
      [   33.694221] pgd = ed0cc000
      [   33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000
      [   33.703766] Internal error: Oops: 17 [#1] SMP ARM
      [   33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore
      [   33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345
      [   33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000
      [   33.748116] PC is at usb_udc_softconn_store+0xa4/0xec
      [   33.753416] LR is at mark_held_locks+0x78/0x90
      [   33.758057] pc : [<c04df128>]    lr : [<c00896a4>]    psr: 20000013
      [   33.758057] sp : ee68bec8  ip : c0c00008  fp : ee68bee4
      [   33.770050] r10: ee6b394c  r9 : ee68bf80  r8 : ee6062c0
      [   33.775508] r7 : 00000000  r6 : ee6062c0  r5 : 0000000b  r4 : ee739408
      [   33.782346] r3 : 00000000  r2 : 00000000  r1 : ee71d390  r0 : ee664170
      [   33.789168] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
      [   33.796636] Control: 10c5387d  Table: ad0cc059  DAC: 00000015
      [   33.802638] Process bash (pid: 1457, stack limit = 0xee68a248)
      [   33.808740] Stack: (0xee68bec8 to 0xee68c000)
      [   33.813299] bec0:                   0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8
      [   33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940
      [   33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000
      [   33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000
      [   33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0
      [   33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34
      [   33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8
      [   33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000
      [   33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000
      [   33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565
      [   33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34)
      [   33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60)
      [   33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194)
      [   33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc)
      [   33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0)
      [   33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48)
      [   33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014)
      [   33.954625] ---[ end trace f849bead94eab7ea ]---
      
      Fixes: 2ccea03a (usb: gadget: introduce UDC Class)
      Cc: <stable@vger.kernel.org> # v3.1+
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      bfa6b18c
    • S
      usb: musb: musb_dsps: fix NULL pointer in suspend · f042e9cb
      Sebastian Andrzej Siewior 提交于
      So testing managed to configure musb in DMA mode but not load the
      matching cppi41 driver for DMA. This results in
      
      |musb-hdrc musb-hdrc.0.auto: Failed to request rx1.
      |musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -517
      |platform musb-hdrc.0.auto: Driver musb-hdrc requests probe deferral
      
      which is "okay". Once the driver is loaded we re-try probing and
      everyone is happy. Until then if you try suspend say
          echo mem > /sys/power/state
      then you go boom
      
      |Unable to handle kernel NULL pointer dereference at virtual address 000003a4
      |pgd = cf50c000
      |[000003a4] *pgd=8f6a3831, *pte=00000000, *ppte=00000000
      |Internal error: Oops: 17 [#1] ARM
      |PC is at dsps_suspend+0x18/0x9c [musb_dsps]
      |LR is at dsps_suspend+0x18/0x9c [musb_dsps]
      |pc : [<bf08e268>] lr : [<bf08e268>] psr: a0000013
      |sp : cbd97e00 ip : c0af4394 fp : 00000000
      |r10: c0831d90 r9 : 00000002 r8 : cf6da410
      |r7 : c03ba4dc r6 : bf08f224 r5 : 00000000 r4 : cbc5fcd0
      |r3 : bf08e250 r2 : bf08f264 r1 : cf6da410 r0 : 00000000
      |[<bf08e268>] (dsps_suspend [musb_dsps]) from [<c03ba508>] (platform_pm_suspend+0x2c/0x54)
      |Code: e1a04000 e9900041 e2800010 eb4caa8e (e59053a4)
      
      because platform_get_drvdata(glue->musb) returns a NULL pointer as long as the
      device is not fully probed.
      Tested-by: NGeorge Cherian <george.cherian@ti.com>
      Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      f042e9cb
    • S
      usb: musb: dsps: start OTG timer on resume again · 53185b3a
      Sebastian Andrzej Siewior 提交于
      Commit 468bcc2a ("usb: musb: dsps: kill OTG timer on suspend") stopped
      the timer in suspend path but forgot the re-enable it in the resume
      path. This patch fixes the behaviour.
      
      Cc: <stable@vger.kernel.org> # v3.14+
      Fixes 468bcc2a "usb: musb: dsps: kill OTG timer on suspend"
      Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      53185b3a
    • F
      usb: gadget: loopback: don't queue requests to bogus endpoints · e0857ce5
      Felipe Balbi 提交于
      A request allocated from e.g. ep1out cannot
      be queued to any other endpoint. This bug has
      been in f_loopback at least since mid-2011 and
      since nobody has really screamed about it, we're
      not backporting to any stable kernels.
      
      Debugged with MUSB since that's the only controller
      which complains about this case.
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      e0857ce5
    • D
      usb: ffs: fix regression when quirk_ep_out_aligned_size flag is set · c0d31b3c
      David Cohen 提交于
      The commit '2e4c7553 usb: gadget: f_fs: add aio support' broke the
      quirk implemented to align buffer size to maxpacketsize on out endpoint.
      As result, functionfs does not work on Intel platforms using dwc3 driver
      (i.e. Bay Trail and Merrifield). This patch fixes the issue.
      
      This code is based on a previous Qiuxu's patch.
      
      Fixes: 2e4c7553 (usb: gadget: f_fs: add aio support)
      Cc: <stable@vger.kernel.org> # v3.16+
      Signed-off-by: NDavid Cohen <david.a.cohen@linux.intel.com>
      Signed-off-by: NQiuxu Zhuo <qiuxu.zhuo@intel.com>
      Acked-by: NMichal Nazarewicz <mina86@mina86.com>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      c0d31b3c
    • R
      usb: gadget: f_fs: remove redundant ffs_data_get() · a3058a5d
      Robert Baldyga 提交于
      During FunctionFS bind, ffs_data_get() function was called twice
      (in functionfs_bind() and in ffs_do_functionfs_bind()), while on unbind
      ffs_data_put() was called once (in functionfs_unbind() function).
      In result refcount never reached value 0, and ffs memory resources has
      been never released.
      
      Since ffs_data_get() call in ffs_do_functionfs_bind() is redundant
      and not neccessary, we remove it to have equal number of gets ans puts,
      and free allocated memory after refcount reach 0.
      
      Fixes: 5920cda6 (usb: gadget: FunctionFS: convert to new function
      	interface with backward compatibility)
      Cc: <stable@vger.kernel.org> # v3.14+
      Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      a3058a5d
    • G
      usb: gadget: udc: USB_GADGET_XILINX should depend on HAS_DMA · f1113be1
      Geert Uytterhoeven 提交于
      If NO_DMA=y:
      
      drivers/built-in.o: In function `xudc_done':
      udc-xilinx.c:(.text+0x54f4d2): undefined reference to `usb_gadget_unmap_request'
      drivers/built-in.o: In function `xudc_dma_send':
      udc-xilinx.c:(.text+0x54f9f8): undefined reference to `dma_sync_single_for_cpu'
      drivers/built-in.o: In function `xudc_read_fifo':
      udc-xilinx.c:(.text+0x54ff4a): undefined reference to `dma_sync_single_for_cpu'
      drivers/built-in.o: In function `xudc_ep_queue':
      udc-xilinx.c:(.text+0x550e7c): undefined reference to `usb_gadget_map_request'
      Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      f1113be1
    • R
      Revert "usb: dwc3: dwc3-omap: Disable/Enable only wrapper interrupts in prepare/complete" · b01ff5cb
      Roger Quadros 提交于
      This reverts commit 02dae36a.
      
      That commit is bogus in two ways:
      
      1) There's no way dwc3-omap's ->suspend() can cause any effect
      	on xhci's ->suspend(). Linux device driver model guarantees
      	that a parent's ->suspend() will only be called after all
      	children are suspended. dwc3-omap is the parent of the
      	parent of xhci.
      
      2) When implementing Deep Sleep states where context is lost,
      	USBOTGSS_IRQ0 register, well, looses context so we
      	_must_ rewrite it otherwise core IRQs will never be
      	reenabled and USB will appear to be dead.
      
      Fixes: 02dae36a (usb: dwc3: dwc3-omap: Disable/Enable only
      	wrapper interrupts in prepare/complete)
      Cc: <stable@vger.kernel.org> # v3.17
      Cc: George Cherian <george.cherian@ti.com>
      Signed-off-by: NRoger Quadros <rogerq@ti.com>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      b01ff5cb